Code execution vulnerabilities.
These type of vulnerabilities allow us to execute our operating system code on the target server.
So if the target server uses Windows, we'll be able to execute Windows commands.
If it uses Linux, then we'll be able to use Linux commands.
Clearly this is a really critical problem that would allow us to do anything we want with the target.
Really.
We can upload a PHP shell using w get command or upload a payload, a virus, anything we want using
the w w get linux command.
You just need to make sure that you're uploading it to a file or to a directory which you're allowed
to write stuff to.
Another way of exploiting this vulnerability is to just run OS commands and get a reverse shell based
on these commands.
So because we can run operating system commands, we can use the programming language supported by that
operating system to try and get a reverse connection or on our computer.
So first of all, let's just assume that we're browsing here and we manage to we're going around and
then we got to a tab and the website where it allows you to, for example, do a ping.
Now what you should do is you should always try to experiment with any input box you see.
Try to see what the input box does and what can you inject into it.
What can you do to get stuff running?
So for example, this input box is telling you it's going to do a ping.
And if you pull an IP, for example, I'm going to put ten 2014 to oh three, which is my own IP, just
to see it, to use it as a normal person.
And I'm going to do a submit and it's going to go ahead and ping it for me and give me the ping results.
So what looks like here, it's actually executing the ping command.
And Linux systems.
Now let's see if we can exploit that if it's actually executing the command.
So what it's doing is it's going and it's doing.
So we're sending ten 2014 to oh three as the ping and then it's going to to the web server and the web
server is doing ping.
Ten 2014 203.
So let's see if we can exploit this.
How would we exploit it if it's taken what we're inputting right here and then it's doing ping that.
Now in Linux and Unix based commands, you can use the this sign to execute multiple commands on one
line.
So if you do this if for example in your own terminal, so I'm just going to go to my terminal here
and I'm just going to do LRS, which is the list command.
And then PWT is what lists what shows your working directory.
So if I do an RLS followed by this sign and then do PWT, it'll execute both commands.
So it will do this and then it will show where the working directory is.
So we can do the same thing with this and see if it works for us.
So we're going to put an IP.
All right, IP.
And then I'm just going to do p WD and see if it'll execute the P wd for me.
If it does, then this is a code execution vulnerability and I can execute anything I want on the server.
So let's see what's going to happen.
I pasted this and I'm going to hit Submit.
And as we can see, we get pink results.
But at the end we got our current working directory.
So it's var w w w d v w a vulnerability is an exec.
So it executed the pwt that I inserted and that means I can insert any commands I want in there and
they'll be executed.
So I've inserted a resources file that will that you can use to get reverse connection from the target
computer.
Now, there's a number of ways, a number of commands that would give you a reverse connection.
All of these commands depend on the programming language.
So, for example, we have commands in PHP, we have commands in Ruby, you have Perl commands and we
have the one for Bash.
Bash is the.
Linux Shell Command language.
So all Unix operating systems will be able to execute bash commands.
So that's a very, very good way of doing it.
So most UNIX system, this command should work on most UNIX based systems.
So this would be a really good way of doing it.
Again, most of them would have Python, so Python would be a good way net, but most of them do have
net cat as well.
So net cat is a good way of doing that.
And we're actually going to use Net Cat in this video.
So what I'm going to do is first I'm going to listen for connections, just like we used to do with
Metasploit when we used to do multi handler.
You can actually use a multi handler for this and listen for connections, but I'm just going to keep
it simpler and show you a new way and I'm going to use net cat.
So net cat.
NASCAR is just a tool that allows you to listen and connect computers together.
So I'm going to listen on fourth.
88.
So in that cut is the program V is just to see verbose outward so we can see a lot of output.
Anything goes wrong, we can see it and we're telling it to listen using the L option on Port 8080.
So I'm going to hit enter and that's saying it's just listening on port 88.
That's all it's going to do.
The next command we're going to do is we're going to try to connect from the Web server back to my computer
using that cat as well.
So we're assuming the Web server has that cat.
We're going to try it and see if that works.
So the command is very simple.
It's net cat and we're telling it to use the bin bash.
And we're giving it the IP of my device, my attacker device, which is ten 2014.
And then the port which is 8080, which is we're listening on right here.
So I'm going to copy that.
And I'm just going to execute it the same way we used to execute the P.W..
DPW command.
So the last thing we did was 1020.
14 to oh three.
And then we did.
So what I'm going to do now, I'm going to remove the PDF and paste the code that we just created,
which will try to connect from the web server back to the machine to the attacker machine.
And I'm going to come here.
And as you can see, we've got a connection back from to to us from ten 2014 to oh four.
So that's the target computer.
And if we do a DWD, you'll see that we have a reverse shell.
If we do an LS, if we do an ID, you'll see that we're WWE data.
And if we do a you name a just to confirm.
That I'm in the Metasploit bubble and you can see that I'm on the Metasploit table and I'm able to run
any command that I want on the target computer.
So basically I have full access to the target computer.